{"id":"CVE-2026-123548","aliases":[],"cve":{"records":[{"id":"CVE-2026-123548","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:49:30.576Z","published":"2026-11-08T01:37:52.819Z","modified":"2026-11-12T12:54:22.987Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:37:52.819Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T12:54:22.987Z"}],"references":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-mgwg-24cx-c8w3","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-via-ws-federation-and-saml-2.0-pages","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-601","description":"URL Redirection to Untrusted Site ('Open Redirect')","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*","versionEndExcluding":"16.1.4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*","versionEndExcluding":"16.1.4"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T12:53:35.968589Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.","score":4.7,"severity":"medium","published":"2026-11-08T01:37:52.819Z","modified":"2026-11-12T12:54:22.987Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"OpenIdentityPlatform","name":"OpenAM","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"16.1.4","versionType":"semver"},{"version":"16.1.4","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.openidentityplatform.openam/openam-server-only","packageIdentity":{"ecosystem":"Maven","name":"org.openidentityplatform.openam:openam-server-only"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123548"},{"vendor":"OpenIdentityPlatform","name":"OpenAM","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"16.1.4","versionType":"semver"},{"version":"16.1.4","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.openidentityplatform.openam/openam-federation-library","packageIdentity":{"ecosystem":"Maven","name":"org.openidentityplatform.openam:openam-federation-library"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123548"}],"remediation":[],"references":["https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-mgwg-24cx-c8w3","https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-via-ws-federation-and-saml-2.0-pages"],"sources":[{"name":"CVE","id":"CVE-2026-123548","modified":"2026-11-12T12:54:22.987Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123548"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","score":2.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","score":4.7}],"sourceAffected":[],"observedAt":"2026-11-12T19:30:03.182Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T04:35:30.440Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T03:15:35.921Z","attemptedAt":"2026-11-08T03:15:35.921Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T03:15:36.222Z","attemptedAt":"2026-11-08T03:15:36.222Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-08T03:15:36.670Z","attemptedAt":"2026-11-08T03:15:36.670Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T03:15:36.925Z","attemptedAt":"2026-11-08T03:15:36.925Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-123548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123548","modified":"2026-11-08T02:16:46.093","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T03:15:35.921Z"},{"source":"NVD","id":"CVE-2026-123548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123548","modified":"2026-11-08T02:16:46.093","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-11-08T03:15:35.921Z"},{"source":"ENISA EUVD","id":"EUVD-2026-119433","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119433","modified":"Nov 8, 2026, 1:37:52 AM","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","checkedAt":"2026-11-08T03:15:36.670Z"}],"aiSummary":{"text":"OpenAM before 16.1.4 has an open redirect vulnerability because certain pages do not check destination URLs against allowed lists, allowing attackers to craft links that send users to arbitrary external sites. The affected pages include WS-Federation logout and SAML v2.0 logout and name-identifier management. An attacker can potentially use this for phishing.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T02:21:32.404Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123548"}]}}